nuclei-templates/file/malware/bublik-malware.yaml

id: bublik-malware

info:
  name: Bublik Malware Detector
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Bublik.yar
  tags: malware,file
file:
  - extensions:
      - all
    matchers:
      - type: binary
        binary:
          - '636F6E736F6C6173'
          - '636C556E00696E666F2E696E69'
        condition: and
# digest: 4b0a004830460221009029ffcbb9716b8acc87ec74070f03932fc5fbe89d769df9be734ef01acbc69c0221008ea7ad264388c36527ea1e95275a4e8ffd88ff92e4e91a75e6ba2188263e7985:922c64590222798bb761d5b6d8e72950